CP695435 (Community Member) asked a question.
I have typical constant java file which starts with
package com.ceracode.common;
public class TransferConstants { ... }
On line of package it shows flaw id : Use of Hard-coded Password (CWE ID 259)(3
flaws)
package com.ceracode.common;
public class TransferConstants { ... }
On line of package it shows flaw id : Use of Hard-coded Password (CWE ID 259)(3
flaws)
Dont know how i can fix this. Because this is just constants.
public static final String FILE_PASSWORD = "FILE_PASSWORD";
public static final String PASSWORD = "PASSWORD";
I tried renaming variables but nothing worked for me. What is causing this issue to be raised on this file.
.png){kind=logo}
Hi, The CWE 259 - Use of Hardcoded Password flaws are data flow insensitive. The scanner reports based on certain keywords. It considers naming practices, data structure, variable usage, etc to determine whether a value may be a password.
Since hardcoded passwords can seriously impact the security posture of an application, we take it seriously and report values where usage is more ambiguous. We are also working on improving true positive findings.
Hence, I recommend reviewing the finding to determine the usage context: if the value is a hardcoded password and take appropriate action.
If these are just constants, and not real password, then you may mitigate these flaws on the Veracode platform.
You can find steps on how to mitigate flaws here - https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ